Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Sunday September 22 2019, @01:13AM   Printer-friendly
from the security-as-an-afterthought dept.

Arthur T Knackerbracket has found the following story:

The images consisted of photos of cars taken as they entered and left 19 Tesco car parks spread across the country. Visible and highlighted were the cars' numberplates, though drivers were not visible in the low-res images seen by The Register.

Used to power the supermarket’s outsourced parkshopreg.co.uk website, the Azure blob had no login or authentication controls. Tesco admitted to The Register that “tens of millions” of timestamped images were stored on it, adding that the images had been left exposed after a data migration exercise.

Ranger Services, which operated the Azure blob and the parkshopreg.co.uk web app, said it had nothing to add and did not answer any questions put to it by The Register. We understand that they are still investigating the extent of the breach. The firm recently merged with rival parking operator CP Plus and renamed itself GroupNexus.

Tesco customers across the nation were instructed to use parkshopreg.co.uk to validate their parking with a code printed on their receipts along with their vehicle’s registration number, thus avoiding parking charges.

Live ANPR [automatic number plate recognition] images were saved to the blob as timestamped jpegs with the time information also contained within the image filenames, allowing anyone with access to harvest the images in bulk for illicit use. Tens of millions of images were freely available to anyone who could correctly deduce the format of the required HTTP POST request.

The Tesco car parks affected by the breach include Braintree, Chelmsford, Chester, Epping, Fareham, Faversham, Gateshead, Hailsham, Hereford, Hove, Hull, Kidderminster, Woolwich, Rotherham, Sale (Cheshire), Slough, Stevenage, Truro, Walsall and Weston-super-Mare.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by kazzie on Sunday September 22 2019, @08:09PM

    by kazzie (5309) Subscriber Badge on Sunday September 22 2019, @08:09PM (#897242)

    Most Tesco stores don't charge for parking, like other supermarkets.

    Of those listed, I'm only familiar with the Chester branch. The supermarket is on the edge of the city centre, and has a car part on top(?) of the store. I've never parked there myself, but I could understand them wanting to ensure only their customers park at their very-central location (or at least charge others for the privilege).

    However, on further thought, I'm pretty sure that some of their out-of-town locations have automated cameras and signs saying "4 hours parking free. Talk to customer services if you need more time" . Those musr be on a separate system, as they're not with the handful listed in TFA.

    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2